Add missing locking.

Whilst here, assert that the lock is held when calling epstop().

Tested:

ep0: <3com Megahertz 574B>